fedora-rpi: Start chrony-wait before host certs

On machines without an RTC, the clock will likely be very wrong on first
boot when system tries to obtain the initial SSH host certificates.
This results in the SSHCA server rejecting the request because the
authorization token has expired.  To avoid this, we need to ensure the
clock is set before attempting to have the certificates signed.

fedora-rpi.ks

@@ -26,4 +26,13 @@ uboot-images-armv8
 cp -P /usr/share/uboot/rpi_arm64/u-boot.bin /boot/efi/rpi-u-boot.bin
 
 grubby --args='quiet systemd.show_status=1' --update-kernel=ALL
+
+systemctl enable chrony-wait
+# Ensure clock is synchronized before trying to get host certs signed
+mkdir -p /etc/systemd/system/ssh-host-cert-sign@.service.d
+cat > /etc/systemd/system/ssh-host-cert-sign@.service.d/time-sync.conf <<EOF
+[Unit]
+After=time-sync.target
+Wants=time-sync.target
+EOF
 %end